Microsoft Zero-day Patch Fail Exposes Vulnerability

Every Microsoft Windows version is potentially at risk after Microsoft failed to fix a zero-day problem. Researchers believe that while the vulnerability is nominal, the continued testing of this exploit can lead to a wide scaled malware attack.

Nick Biasini, the head of outreach at Cisco Talos, told BleepingComputer, "During our investigation, we looked at recent malware samples and were able to identify several [bad actors] that were already attempting to leverage the exploit. Since the volume is low, this is likely people working with the proof of concept code or testing for future campaigns."

According to experts, the bug takes advantage of Windows Installer to give users SYSTEM privilege, the highest user rights provided by Windows. Once the privilege is obtained, hackers can take over the system by replacing any executable file with an MSI file.

Microsoft allegedly fixed the bug earlier this month. but security researcher Abdelhamid Naceri ran a proof-of-concept code to show that the vulnerability was not fixed. Rather, the new patch allows users to bypass an important policy in the admin install section of Windows.

"This variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass. I have chosen to actually drop this variant as it is more powerful than the original one," Naceri wrote in his post on GitHub.

The only respite that individual users can have is that this bug is not accessible remotely so malpractioners will need to have access to the computer to hack it.

Nazeri also stated that he did not notify Microsoft immediately as it is also going to fetch him monetary compensation in the bug-bounty program. He believes that if third-party software companies try to find a fix to this, it can break the installer altogether, so it is best if Microsoft updates the patch to solve the problem.

"We are aware of the disclosure and will do what is necessary to keep our customers safe and protected. An attacker using the methods described must already have access and the ability to run code on a target victim's machine," Microsoft told BleepingComputer as it plans to launch another patch to fix the malfunction.

For comments and feedback contact: editorial@rttnews.com

Business News

Editors Pick
Frozen Food Development is recalling specific lots of Lidl branded 12-ounce packages of Frozen Chopped Spinach citing the potential to be contaminated with Listeria monocytogenes, the U.S. Food and Drug Administration said. The product comes in 12-ounce poly bags, and items included in the recall are marked with lot # R17742 or R17963 on the back of the poly bag with a best by date of 09/10/23. Starbucks has dropped its vaccine or weekly test requirement against Covid-19 for U.S. employees in the wake of last week's U.S. Supreme Court ruling. The court, in a 6-3 vote, has blocked President Joe Biden's vaccine-or-test mandate for private companies with 100 or more employees. However, it allowed the vaccine mandate to stand for certain health care workers. Mylan Pharmaceuticals Inc., affiliated to healthcare company Viatris Inc., is recalling one batch of its non-interchangeable Semglee (insulin glargine injection), 100 units/ml (U-100), 3mL prefilled pens due to the potential for a missing label, the U.S. Food and Drug Administration said.
Follow RTT